<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.callbacks.Callbacks : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.c.Callbacks(<a href="volatility.plugins.common.AbstractWindowsCommand.html">common.AbstractWindowsCommand</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.callbacks.html">callbacks</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.callbacks.Callbacks">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>Print system-wide notification routines<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id275">
  
  
<tr class="staticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#is_valid_profile">is_valid_profile</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#__init__">__init__</a></td>
    <td><span>Constructor uses args as an initializer. It creates an instance of OptionParser, populates the options, and finally parses the command line. Options are stored in the self.opts attribute.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_kernel_callbacks">get_kernel_callbacks</a></td>
    <td><span>Enumerate the Create Process, Create Thread, and Image Load callbacks.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_fs_callbacks">get_fs_callbacks</a></td>
    <td><span>Enumerate the File System change callbacks</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_shutdown_callbacks">get_shutdown_callbacks</a></td>
    <td><span>Enumerate shutdown notification callbacks</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_bugcheck_callbacks">get_bugcheck_callbacks</a></td>
    <td><span>Enumerate generic Bugcheck callbacks.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_registry_callbacks_legacy">get_registry_callbacks_legacy</a></td>
    <td><span>Enumerate registry change callbacks.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_generic_callbacks">get_generic_callbacks</a></td>
    <td><span>Enumerate generic callbacks of the following types:</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_dbgprint_callbacks">get_dbgprint_callbacks</a></td>
    <td><span>Enumerate DebugPrint callbacks on Vista and 7</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_registry_callbacks">get_registry_callbacks</a></td>
    <td><span>Enumerate registry callbacks on Vista and 7.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_pnp_callbacks">get_pnp_callbacks</a></td>
    <td><span>Enumerate IoRegisterPlugPlayNotification</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#get_bugcheck_reason_callbacks">get_bugcheck_reason_callbacks</a></td>
    <td><span>Enumerate Bugcheck Reason callbacks.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#calculate">calculate</a></td>
    <td><span>This function is responsible for performing all calculations</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.callbacks.Callbacks.html#render_text">render_text</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.commands.Command.html">Command</a> (via <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>):
        </p>
        <table class="children sortable" id="id276">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.commands.Command.html#register_options">register_options</a></td>
    <td><span>Registers options into a config object provided</span></td>
  </tr><tr class="baseclassmethod">
    
    
    <td>Class Method</td>
    <td><a href="volatility.commands.Command.html#help">help</a></td>
    <td><span>This function returns a string that will be displayed when a user lists available plugins.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#execute">execute</a></td>
    <td><span>Executes the plugin command.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#format_value">format_value</a></td>
    <td><span>Formats an individual field using the table formatting codes</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_header">table_header</a></td>
    <td><span>Table header renders the title row of a table</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_row">table_row</a></td>
    <td><span>Outputs a single row of a table</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_formatlookup">_formatlookup</a></td>
    <td><span>Code to turn profile specific values into format specifications</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_elide">_elide</a></td>
    <td><span>Adds three dots in the middle of a string if it is longer than length</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.is_valid_profile">
    
  </a>
  <a name="is_valid_profile">
    
  </a>
  <div class="functionHeader">
    @staticmethod<br />
    def
    is_valid_profile(profile):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.plugins.common.AbstractWindowsCommand.html#is_valid_profile">volatility.plugins.common.AbstractWindowsCommand.is_valid_profile</a></div>
    <div class="undocumented">Undocumented</div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, *args, **kwargs):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#__init__">volatility.commands.Command.__init__</a></div>
    <div>Constructor uses args as an initializer. It creates an instance
of OptionParser, populates the options, and finally parses the
command line. Options are stored in the self.opts attribute.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_kernel_callbacks">
    
  </a>
  <a name="get_kernel_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_kernel_callbacks(self, nt_mod):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate the Create Process, Create Thread, and Image Load callbacks.</p>
<p>On some systems, the byte sequences will be inaccurate or the exported
function will not be found. In these cases, the PoolScanGenericCallback
scanner will pick up the pool associated with the callbacks.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_fs_callbacks">
    
  </a>
  <a name="get_fs_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_fs_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate the File System change callbacks<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_shutdown_callbacks">
    
  </a>
  <a name="get_shutdown_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_shutdown_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate shutdown notification callbacks<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_bugcheck_callbacks">
    
  </a>
  <a name="get_bugcheck_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_bugcheck_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate generic Bugcheck callbacks.</p>
<p>Note: These structures don't exist in tagged pools, but you can find
them via KDDEBUGGER_DATA64 on all versions of Windows.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_registry_callbacks_legacy">
    
  </a>
  <a name="get_registry_callbacks_legacy">
    
  </a>
  <div class="functionHeader">
    
    def
    get_registry_callbacks_legacy(self, nt_mod):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate registry change callbacks.</p>
<p>This method of finding a global variable via disassembly of the
CmRegisterCallback function is only for XP systems. If it fails on
XP you can still find the callbacks using PoolScanGenericCallback.</p>
<p>On Vista and Windows 7, these callbacks are registered using the
CmRegisterCallbackEx function.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_generic_callbacks">
    
  </a>
  <a name="get_generic_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_generic_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate generic callbacks of the following types:</p>
<ul class="rst-simple">
<li>PsSetCreateProcessNotifyRoutine</li>
<li>PsSetThreadCreateNotifyRoutine</li>
<li>PsSetLoadImageNotifyRoutine</li>
<li>CmRegisterCallback (on XP only)</li>
<li>DbgkLkmdRegisterCallback (on Windows 7 only)</li>
</ul>
<p>The only issue is that you can't distinguish between the types by just
finding the generic callback structure<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_dbgprint_callbacks">
    
  </a>
  <a name="get_dbgprint_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_dbgprint_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate DebugPrint callbacks on Vista and 7<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_registry_callbacks">
    
  </a>
  <a name="get_registry_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_registry_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate registry callbacks on Vista and 7.</p>
<p>These callbacks are installed via CmRegisterCallback
or CmRegisterCallbackEx.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_pnp_callbacks">
    
  </a>
  <a name="get_pnp_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_pnp_callbacks(self):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate IoRegisterPlugPlayNotification<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.get_bugcheck_reason_callbacks">
    
  </a>
  <a name="get_bugcheck_reason_callbacks">
    
  </a>
  <div class="functionHeader">
    
    def
    get_bugcheck_reason_callbacks(self, nt_mod):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate Bugcheck Reason callbacks.</p>
<p>Note: These structures don't exist in tagged pools, so we
find them by locating the list head which is a non-exported
NT symbol. The method works on all x86 versions of Windows.</p>
<p>mov [eax+KBUGCHECK_REASON_CALLBACK_RECORD.Entry.Blink],                 offset _KeBugCheckReasonCallbackListHead<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.calculate">
    
  </a>
  <a name="calculate">
    
  </a>
  <div class="functionHeader">
    
    def
    calculate(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#calculate">volatility.commands.Command.calculate</a></div>
    <div>This function is responsible for performing all calculations</p>
<p>We should not have any output functions (e.g. print) in this
function at all.</p>
<p>If this function is expected to take a long time to return
some data, the function should return a generator.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.callbacks.Callbacks.render_text">
    
  </a>
  <a name="render_text">
    
  </a>
  <div class="functionHeader">
    
    def
    render_text(self, outfd, data):
    
  </div>
  <div class="functionBody">
    
    <div class="undocumented">Undocumented</div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>